# Chromecast

Irc for discussions: Freenode #teameureka

URLs for versions:

- [46278](http://cache.pack.google.com/edgedl/googletv-eureka/stable-channel/ota.46278.stable-channel.eureka-b3.ef7fdf1f7153dacecc77b7d1a3bb22a97e27ec7e.zip)
- [80438](http://redirector.gvt1.com/edgedl/googletv-eureka/stable-channel/ota.80438.stable-channel.eureka-b3.58634c32e910f395736070dfd0d4146a86d1450d.zip)
- [84839](http://redirector.gvt1.com/edgedl/googletv-eureka/stable-channel/ota.84839.stable-channel.eureka-b3.d6f360302fb7115e7825d1402539e725bac905d0.zip)
- [88007](http://redirector.gvt1.com/edgedl/googletv-eureka/stable-channel/ota.88007.stable-channel.eureka-b3.21d42fb3e90192f4163119560ab06d0177431041.zip)
- [104827](http://redirector.gvt1.com/edgedl/googletv-eureka/stable-channel/ota.104827.stable-channel.eureka-b3.7cd352588b537080bd4f7ee52afb376d0ddf3d0d.zip)
- [124602](http://redirector.gvt1.com/edgedl/googletv-eureka/stable-channel/ota.124602.stable-channel.eureka-b3.e1232bf3ebbc71c933b5c215ea2d9bf366a70dac.zip)
- [141268](http://redirector.gvt1.com/edgedl/googletv-eureka/stable-channel/ota.141268.stable-channel.eureka-b3.cdde73df6699a2d7694c1e7b30cfa0487171c8aa.zip)
- [159268](http://redirector.gvt1.com/edgedl/googletv-eureka/stable-channel/ota.159268.stable-channel.eureka-b3.adf9f4e6b7ad7068e5f85dbb375236d5d933031b.zip)

Extracted using [binwalk](https://github.com/devttys0/binwalk) (`binwalk -e `), and then the recover extracted from `_boot.img.extracted/1CC100` using the same.

### Potentially interesting changes:

#### Recovery init.rc (_boot.img.extracted/_1CC100.extracted/init.rc)
diff -r 80438/recovery/init.rc 84839/recovery/init.rc
64a65,67
> # set KEYSTORE for cast_crypto_keys_marvell.cc
> export KEYSTORE /data/netflix/AACS
>
65a69,71
> # Load device mapper table
> exec /sbin/dmsetup create system -r /dmtable
>
68c74
< mount squashfs mtd@rootfs /system ro nodev noatime
---
> mount squashfs /dev/mapper/system /system ro nodev noatime
180a187,189
>
> # Set kernel configuration
> exec /bin/sysctl -p

## Most likely cause of the issue

Note the `/dmtable` addition above. It looks like Google is now signing their system image and checking it in the initramfs during boot, and mounting based on it's mapped endpoint. This endpoint is ONLY made if dmsetup is able to verify the signature.

You can view this `/dmtable` file at `_boot.img.extracted/_1CC100.extracted/cpio-root/dmtable`

#### Contents of `/dmtable` from the initramfs
0 180864 verity 1 /dev/block/mtdblock3 /dev/block/mtdblock3 4096 4096 22608 22608 sha256 c244bdd1892f3cf1b49b6263ada8fc24fdf773e777643506f6a9dcd6f871a4f9 1c93138393bf240ebc47a5b13ba75bdc80c0607f1f8e88391c0b668a531a9322

More reading can be found [Here](https://gitlab.com/cryptsetup/cryptsetup/wikis/DMVerity) on DM Verity.

What does this for AutoRoot? Unless a way to edit & repack the initramfs in a systematic and SAFE way can be found, not too much can be done.

IF this can be done, solution should be simple unless there are extra hidden tricks:

In `/init.rc`, remove:

exec /sbin/dmsetup create system -r /dmtable
...
mount squashfs /dev/mapper/system /system ro nodev noatime

and replace with:

# exec /sbin/dmsetup create system -r /dmtable
...
mount squashfs mtd@rootfs /system ro nodev noatime

#### Kernel (_boot.img.extracted/6AD5)

TODO:
- [x] Try extracting Config
- [x] Try [bindiff](https://security.googleblog.com/2016/03/bindiff-now-available-for-free.html) on both

From `strings` on both, the kernel was rebuilt:

< Linux version 3.8.13+ (user@host) (gcc version 4.9.x 20150123 (prerelease) (4.9.2_cos_gg_a2bc87a_4.9.2-r128) ) #0 PREEMPT Mon Oct 31 22:17:58 2016 +0000 (bfb4e546)
> Linux version 3.8.13+ (user@host) (gcc version 4.9.x 20150123 (prerelease) (4.9.2_cos_gg_4.9.2-r145-41f3 e25635616c067b9ee272304e6f86ac8ee9db_4.9.2-r145) ) #0 PREEMPT Fri Feb 3 09:54:31 2017 -0800 (033bf506)

##### Bootloader

84839 contains a new `bootloader.eureka-b3`.

TODO:
- [ ] Bindiff/RE the bootloader (tchebb: this won't get you anywhere since bootloader images are encrypted. It's unlikely there have been changes. They re-encrypt the bootloader every OTA even if the code hasn't changed at all)
- [ ] Figure out how/where bootloader stored and entry point

Bootloader is flashed with (META-INF/com/google/android/updater-script)

assert(package_extract_file("bootloader.eureka-b3", "/tmp/bootloader.img"),
run_program("/bin/flash_bootloader", "eureka-b3", "/tmp/bootloader.img"),
delete("/tmp/bootloader.img"));

Rebuild boot.img
-
Here is how you can unpack/repack a boot.img from chromecast ota.zip file

1. Extract regular android boot image, by removing Marvell Cryptographic Header

`dd bs=256 skip=1 if=boot.img of=aboot.img`

2. Use abootimg tool to extract initrd from regular andoroid boot image (initrd.img)

`abootimg -x aboot.img`

3. extract conents of initrd

    mkdir rd; cd rd;
    xz -d -c ../initrd.img | cpio -i -d -H newc --no-absolute-filenames

4. Re-create initrd after modifications.
(kernel does not have crc64 check, so use crc32)
(`find .` includes `.` in the archive, use `*` instead)
(`--device-independent --no-absolute-filenames`?)
`find * | cpio -o -H newc 2>/dev/null | xz --lzma2=dict=64MiB --check=crc32 -z > ../initrd.img`

5. Update regular android boot image

    cd ..
    abootimg -u aboot.img -r initrd.img

6. make it bootable for chromecast by adding Marvell cryptographic header

`dd bs=256 seek=1 if=aboot.img of=boot.img`

If the image is made larger it's possible the crypto header will have to be updated with the new size. See `cc-mangle-bootimg` for an example.

Image may not be able to be managed with `cc-mangle-bootimg aboot.img boot.img 0x02` as it removes the `cmdline`